Customer Security Advisory: Critical F5/NGINX Out-of-Band Vulnerabilities

Timeline

1. 23 Oct · 21:58 UTC 🟡 Identified atom

   Oct 23, 21:55 UTC
   Update - Akamai continues to investigate the potential impact of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) across our platform and infrastructure. Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications. If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.
   
   Oct 23, 20:03 UTC
   Monitoring - Akamai continues to investigate the potential impact of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) across our platform and infrastructure.As part of our initial assessment, we included EAA, MFA, and SIA in the affected component selection. Based on our investigation to date, we have determined that these offerings are not vulnerable to these CVEs and have updated the affected component selection accordingly. We apologize for any concern this may have caused.Our teams continue to monitor the situation closely and respond where necessary. We will update the affected components as our investigation progresses.Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications.If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.
   
   Oct 23, 17:18 UTC
   Identified - Akamai continues to investigate the potential impact of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) acros

2. 23 Oct · 21:55 UTC 🟡 Identified atom

   Oct 23, 21:55 UTC
   Update - We are continuing to monitor for any further issues.
   
   Oct 23, 20:03 UTC
   Monitoring - Akamai continues to investigate the potential impact of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) across our platform and infrastructure.As part of our initial assessment, we included EAA, MFA, and SIA in the affected component selection. Based on our investigation to date, we have determined that these offerings are not vulnerable to these CVEs and have updated the affected component selection accordingly. We apologize for any concern this may have caused.Our teams continue to monitor the situation closely and respond where necessary. We will update the affected components as our investigation progresses.Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications.If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.
   
   Oct 23, 17:18 UTC
   Identified - Akamai continues to investigate the potential impact of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) across our platform and infrastructure. Our teams are taking action where necessary and will provide additional updates as more information becomes available.Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications.If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/su

3. 23 Oct · 20:03 UTC ⚪ Monitoring atom

   Oct 23, 20:03 UTC
   Monitoring - Akamai continues to investigate the potential impact of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) across our platform and infrastructure.As part of our initial assessment, we included EAA, MFA, and SIA in the affected component selection. Based on our investigation to date, we have determined that these offerings are not vulnerable to these CVEs and have updated the affected component selection accordingly. We apologize for any concern this may have caused.Our teams continue to monitor the situation closely and respond where necessary. We will update the affected components as our investigation progresses.Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications.If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.
   
   Oct 23, 17:18 UTC
   Identified - Akamai continues to investigate the potential impact of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) across our platform and infrastructure. Our teams are taking action where necessary and will provide additional updates as more information becomes available.Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications.If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.
   
   Oct 22, 20:17 UTC
   Investigating - Akamai is aware of the recently publis

4. 23 Oct · 17:18 UTC ⚪ Identified atom

   Oct 23, 17:18 UTC
   Identified - Akamai continues to investigate the potential impact of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) across our platform and infrastructure. Our teams are taking action where necessary and will provide additional updates as more information becomes available.Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications.If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.
   
   Oct 22, 20:17 UTC
   Investigating - Akamai is aware of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479), and our teams are investigating their potential impact across our platform and infrastructure.F5 has released out-of-band security patches addressing three critical severity vulnerabilities in NGINX Open Source and NGINX Plus. These vulnerabilities may allow unauthenticated attackers to trigger heap buffer overflows, which could cause a denial of service or potential remote code execution if ASLR is bypassed.If you are running a vulnerable version of NGINX Open Source or NGINX Plus, we recommend following guidance from F5/NGINX and applying available patches.We will post more details for customers and partners with a valid Control Center login at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications as additional information becomes available. If you have questions or are experiencing an impact due to this issue, please use the Support Center on Akamai Community, or Akamai Control Center, to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.

5. 22 Oct · 20:17 UTC ⚪ Investigating atom

   Oct 22, 20:17 UTC
   Investigating - Akamai is aware of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479), and our teams are investigating their potential impact across our platform and infrastructure.F5 has released out-of-band security patches addressing three critical severity vulnerabilities in NGINX Open Source and NGINX Plus. These vulnerabilities may allow unauthenticated attackers to trigger heap buffer overflows, which could cause a denial of service or potential remote code execution if ASLR is bypassed.If you are running a vulnerable version of NGINX Open Source or NGINX Plus, we recommend following guidance from F5/NGINX and applying available patches.We will post more details for customers and partners with a valid Control Center login at https://community.akamai.com/customers/s/group/0F90f000000DFgx/service-incident-notifications as additional information becomes available. If you have questions or are experiencing an impact due to this issue, please use the Support Center on Akamai Community, or Akamai Control Center, to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.